Re: OFFTOPIC: DNSSEC groupthink versus improving DNS

[Mark Andrews <[e-mail]>]

> Mark Andrews wrote:
> 
> > 	Well we could stop caching any DNS data.  That's the only
> > 	way to make it match the credit card industry model where
> > 	changes are instantly available.
> 
> Anyone have any idea how many credit card transactions per second occur?
> 
> Seems to me they are very similar in topology, so even if you only
> cached information for a small amount of time that would mitigate most
> attacks people seem to be so concerned about at present.
> 
> Since the window of opportunity for these sort of attacks would be
> greatly reduced, the cost to commit these types of attacks would greatly
> increase if not be virtually impossible to commit on any kind of scale
> worth doing, so problem solved.

	Except it wouldn't solve NXDOMAIN re-writing and other
	on-path attacks which modify the returned data such that
	it is believed.

	Mark

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>